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Introduction 


In 2017 there were 30 separate active shootings in the United States, the largest number ever recorded by the 
FBI during a one-year period. 1 2 With so many attacks occurring, it can become easy to believe that nothing can 
stop an active shooter determined to commit violence. “The offender just snapped” and “There’s no way that 
anyone could have seen this coming” are common reactions that can fuel a collective sense of a “new normal,” 
one punctuated by a sense of hopelessness and helplessness. Faced with so many tragedies, society routinely 
wrestles with a fundamental question: can anything be done to prevent attacks on our loved ones, our children, 
our schools, our churches, concerts, and communities? 

There is cause for hope because there is something that can be done. In the weeks and months before an attack, 
many active shooters engage in behaviors that may signal impending violence. While some of these behaviors 
are intentionally concealed, others are observable and — if recognized and reported — may lead to a disruption 
prior to an attack. Unfortunately, well-meaning bystanders (often friends and family members of the active 
shooter) may struggle to appropriately categorize the observed behavior as malevolent. They may even resist 
taking action to report for fear of erroneously labeling a friend or family member as a potential killer. Once 
reported to law enforcement, those in authority may also struggle to decide how best to assess and intervene, 
particularly if no crime has yet been committed. 

By articulating the concrete, observable pre-attack behaviors of many active shooters, the FBI hopes to make 
these warning signs more visible and easily identifiable. This information is intended to be used not only by law 
enforcement officials, mental health care practitioners, and threat assessment professionals, but also by parents, 
friends, teachers, employers and anyone who suspects that a person is moving towards violence. 

In 2014, the FBI published a report titled ^4 Study of Active Shooter Incidents in the United States Between 2000 
and 2013. 2 One hundred and sixty active shooter incidents in the United States occurring between 2000 and 2013 
were included in the sample. In this first report, the FBI focused on the circumstances of the active shooting 
events (e.g., location, duration, and resolution) but did not attempt to identify the motive driving the offender, 
nor did it highlight observable pre-attack behaviors demonstrated by the offender. The 2014 report will be 
referred to as the “Phase I” study. 

The present study (“Phase II”) is the natural second phase of that initiative, moving from an examination of 
the parameters of the shooting events to assessing the pre-attack behaviors of the shooters themselves. This 
second phase, then, turns from the vitally important inquiry of “what happened during and after the shooting” 
to the pressing questions of “how do the active shooters behave before the attack?” and, if it can be determined, 
“why did they attack?” The FBI’s objective here was to examine specific behaviors that may precede an attack 
and which might be useful in identifying, assessing, and managing those who may be on a pathway to deadly 
violence. 


1 https://vvww.fbi.qpv/fde-repositorv/active-shooter-in<:idents-us-2016-2017.pdf/view 

2 https://mvw.fbi.aav/fde-repositorv/active-shooter-studv-2000-2013-1 pdf/view 
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Key Findings of the Phase II Study 

1. The 63 active shooters examined in this study did not appear to be uniform in any way such that they 
could be readily identified prior to attacking based on demographics alone. 

2. Active shooters take time to plan and prepare for the attack, with 77% of the subjects spending a week 
or longer planning their attack and 46% spending a week or longer actually preparing (procuring the 
means) for the attack. 

3. A majority of active shooters obtained their firearms legally, with only very small percentages obtaining a 
firearm illegally. 

4. The FBI could only verify that 25% of active shooters in the study had ever been diagnosed with a 
mental illness. Of those diagnosed, only three had been diagnosed with a psychotic disorder. 

5. Active shooters were typically experiencing multiple stressors (an average of 3.6 separate stressors) in the 
year before they attacked. 

6. On average, each active shooter displayed 4 to 5 concerning behaviors over time that were observable to 
others around the shooter. The most frequently occurring concerning behaviors were related to the active 
shooter’s mental health, problematic interpersonal interactions, and leakage of violent intent. 

7. For active shooters under age 18, school peers and teachers were more likely to observe concerning 
behaviors than family members. For active shooters 18 years old and over, spouses/domestic partners were 
the most likely to observe concerning behaviors. 

8. When concerning behavior was observed by others, the most common response was to communicate 
directly to the active shooter (83 °/o) or do nothing (‘ 4 *'Zo). In 41% of the cases the concerning 
behavior was reported to law enforcement. Therefore, just because concerning behavior was recognized 
does not necessarily mean that it was reported to law enforcement. 

9. In those cases where the active shooter’s primary grievance could be identified, the most common 
grievances were related to an adverse interpersonal or employment action against the shooter (49%>). 

10. In the majority of cases (64%) at least one of the victims was specifically targeted by the active shooter. 


*A11 percentages in this report are rounded to the nearest whole number. 
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Methodology 

With the goal of carefully reviewing the pre-attack lives and behaviors of the active shooters, the FBI developed a 
unique protocol of 104 variables covering, among other things: 

h Demographics 

■ Planning and preparation 

■ Acquisition of firearms in relation to the attack 
h Stressors 

■ Grievance formation 

■ Concerning pre-attack behaviors and communications 

■ Targeting decisions 

■ Mental health 


Whereas Phase I analyzed event circumstances that are typically well documented both in law enforcement 
incident reports and reliable open sources 3 , this second phase is substantially based on observations of what are 
often nuanced behavioral indicators demonstrated by the active shooter prior to the attack. Given the subtle nature 
of many of the factors relevant to the inquiry, the FBI decided to use data that have been verified to the greatest 
possible extent, relying almost exclusively on information contained in official law enforcement investigative files. 4 
For this reason. Phase II includes only those cases where the FBI obtained law enforcement investigative files that 
contained “background” materials (e.g., interviews with family members, acquaintances, neighbors; school or 
employment records; writings generated by the subject) adequate to answer the protocol questions. 5 In addition, 
as Phase II focused on identifying pre-attack behaviors of those on a trajectory to violence, active shooting events 
which appeared to be spontaneous reactions to situational factors (e.g., fights that escalated) were excluded. This 
resulted in a final sample of 63 active shooting incidents included in the Phase II study. 

The use of law enforcement investigative case files as the primary source of data makes this study unique in 
comparison to other reports that typically rely upon unverified data derived from open sources. The comprehensive 
evaluation of law enforcement case files for suitability and completeness also contributed to the substantial time it 
has taken to prepare and publish this study. 

The FBI examined whether the 63 cases included in Phase II are representative of the entire Phase I sample 
(N= 160). To identify the differences in the samples between Phase 1 and Phase II (N = 160 versus N = 63), the 
FBI compared those cases that were only in Phase I (n = 97) to those cases included in Phase II (N= 63), assessing 
potential differences between the active shooters (e.g., race, gender, age, and whether the offender committed 
suicide subsequent to the attack), as well as potential differences in the characteristics of the incidents (number of 
victims killed, number of law enforcement officers killed, location of the incident, active shooter movement during 
the event, and if the event concluded prior to the arrival of law enforcement). 


3 Incident overview (e.g., date, location), incident specifics (weapon(s) used, duration of event), and incident outcome (deaths, injuries, resolution). 

4 For one incident, the study relied on publicly available official reports which were based on the complete law enforcement investigative files. 

5 The investigative files did not contain uniform amounts of subject-related behavioral information, as the depth and breadth of investigations varied based on several factors, including available 
resources, the prospect or not of trial, and the complexity of the event. 
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As compared to the 97 cases that were only in Phase I, the 63 cases in Phase II had the following characteristics: 

■ Had a higher number of victims killed on average during each shooting; 

■ Were more likely to end before law enforcement arrived; 

■ Were more likely to include offenders who identified with Asian and Caucasian ethnicity, with active shooters 
identified with African American and Hispanic ethnicity generally underrepresented as compared to Phase I; 

■ Were more likely to occur in an educational facility or a house of worship; and 

■ Were more likely to end with the active shooter committing suicide. 

After cases were identified, a three-stage coding process was utilized. First, two researchers read all case materials 
and independently coded each of the cases across all protocol variables. The researchers took a conservative 
approach to coding, declining to definitively answer any question that was not supported by record evidence. 
Second, another experienced coder (the “reviewer”) also read each investigative file. In the final stage, the coders 
and the reviewer met for each of the 63 cases, compared answers, discussed disagreements, and produced a single 
reconciled set of data. 


SHOOTER DEMOGRAPHICS 

The sample comprised individuals who varied widely along a range of demographic factors making it impossible to 
create a demographic profile of an active shooter. Indeed, the findings and conclusions of this study should be consid¬ 
ered in light of the reality that these 63 active shooters did not appear to be uniform in any way such that they could be 
readily identified prior to attacking based on demographics alone. 

Age: 

The youngest active shooter was 12 years old and the oldest was 88 years old with an average age of 37.8 years. 
Grouping the active shooters by age revealed the following: 


FIGURE 1 



9 










Gender and Race: 

The sample was overwhelmingly male (94%, n = 59), with only four females in the data set (6%, n = 4), and varied 
by race as shown in Figure 2: 6 


FIGURE 2 


Race (N = 63) 



Highest Level of Education 7 : 

None of the active shooters under the age of 18 had successfully completed high school, and one (age 12) had not 
yet entered high school. When known, the highest level of education of adults varied considerably, as shown in 
Figure 3: 


FIGURE 3 


Highest Level of Education Completed - 18 Years and Older 

(n = 55) 


UNKNOWN 

COMPLETED MASTERS/DOCTORATE 
SOME GRADUATE EDUCATION 
COMPLETED FOUR YEAR COLLEGE 
ATTENDED FOUR YEAR COLLEGE 
ATTENDED COMMUNITY COLLEGE/TRADE SCHOOL 
COMPLETED HIGH SCHOOL 
NONE OR SOME HIGH SCHOOL 



*Does not sum to 100% due to rounding. 


6 Descriptors of active shooters' races were obtained from law enforcement records. 

7 Active shooters under the age of 18 (n=8) were excluded in analyses for those variables not typically pertaining to juveniles (e.g., marital status, higher education). 
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Employment: 

The active shooters who were under 18 years old were all students. As featured in Figure 4, nearly equal percent¬ 
ages of the adult active shooters 18 years or older were employed as were unemployed, and 7% (n = 4) were 
primarily students. The rest of the adults were categorized as retired, disabled/receiving benefits, or other/unknown. 


Employment -18 Years and Older 
(n = 55) 


STUDENT 

7% 



OTHER 


RETIRED 


*Does not sum to 100% due to rounding. 


- DISABLED 
2 % 

UNKNOWN 

2 % 


Military: 

Of the active shooters 18 and older, 24% (n = 13) had at least some military experience, with six having served in 
the Army, three in the Marines, two in the Navy, and one each in the Air Force and the Coast Guard. 

Relationship Status: 

The active shooters included in the Phase II study were mostly single at the time of the offense (57%, n = 36). 
Thirteen percent (n = 8) were married, while another 13% were divorced. The remaining 11% were either partnered 
but not married (n = 7) or separated (6%, n = 4). 

Criminal Convictions and Anti-Social Behavior 8 : 

Nineteen of the active shooters aged 18 and over (35%) had adult convictions prior to the active shooting event. 

As visualized in Figure 5, the convictions can be categorized as crimes against society, property, or persons. The 
category of “crimes against society” included offenses such as driving under the influence, disorderly conduct and 
the possession of drug paraphernalia. Both the misdemeanor and felony “crimes against property” involved non-vi¬ 
olent offenses, such as conspiracy to commit theft, theft, possession of stolen property, and criminal mischief. The 
misdemeanor “crimes against persons” were not inherently dangerous, but the felony “crimes against persons” 
involved convictions for criminal sexual assault of a family member, aggravated stalking, and endangering a person 
(although no active shooter was convicted of more than one crime against a person). 


8 The study does not include juvenile adjudications; therefore, we did not ran the analyses on those aged 17 and younger. 
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FIGURE 5 


Adult Criminal Convictions - 18 Years and Older 

(n = 55) 



Felonies 

■ Misdemeanors 

■ None 


*There was only one case where an active shooter had both a felony and a misdemeanor conviction in a single category (under"Property"). 


In sum, the active shooters had a limited history of adult convictions for violent crime and a limited history of adult 
convictions for crime of any kind. 

Because formal criminal proceedings may not capture the full range of anti-social behaviors in a person’s 
background, the FBI also looked for evidence of behaviors that were abusive and/or violent, but which did not 
result in a criminal charge. For some active shooters, no evidence of these behaviors was found, but given that these 
actions by definition did not involve the formal criminal justice system, it is possible that more violent incidents 
occurred than are reported here. 

We found evidence that 62% (« = 39) of the active shooters had a history of acting in an abusive, harassing, or 
oppressive way (e.g., excessive bullying, workplace intimidation); 16% (n = 10) had engaged in intimate partner 
violence; and 11% (« = 7) had engaged in stalking-related conduct. 9 

Considerations 

There were very few demographic patterns or trends (aside from gender) that could be identified, reinforcing the 
concept that there is no one “profile” of an active shooter. Perhaps most noteworthy is the absence of a pronounced 
violent criminal history in an overwhelming majority of the adult active shooters. Law enforcement and threat 
management professionals assessing a potentially violent person may therefore wish to avoid any reliance on 
demographic characteristics or on evidence (or lack thereof) of prior criminal behavior in conducting their 
assessments. 


9 This number may be underrepresented given the high percentage of unknown responses as related to stalking behaviors (68%). 
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PLANNING AND PREPARATION 

This study examined two related but separate temporal aspects of the active shooters’ pre-attack lives — total 
time spent planning the attack and total time spent preparing for the attack. 101112 The purpose in analyzing these 
chronologies was to establish the broad parameters during which active shooters were moving toward the attack 
and to identify behaviors that may have been common during these time periods. 

In this context, planning means the full range of considerations involved in carrying out a shooting attack. This 
includes the decision to engage in violence, selecting specific or random targets, conducting surveillance, and 
addressing all ancillary practical issues such as victim schedules, transportation, and site access. Planning is 
more specific than a general intent to act violently and involves the thought processes necessary to bring about 
an intended outcome. Since planning may primarily be an internal thought process, it was often difficult to find 
objective, observable indications of an active shooter’s planning. In nearly half of the cases, the total time spent 
planning is unknown. However, this is different than declaring that there was no evidence of planning at all, 
because in every case there was at least some evidence that the active shooter planned the attack; the challenge 
was ascertaining when the planning began. 

In establishing the total duration of planning, the FBI looked for evidence of behaviors that were observable (e.g., 
conversations, conducting surveillance) as well as in materials that were private to the active shooter (e.g., journals, 
computer hard drives) and likely unknowable to others until after the attack. As demonstrated in Figure 6, there was a 
wide range of planning duration in the 34 cases where the time spent planning could reasonably be determined. 


FIGURE 6 


Time Spent Planning 



*Does not sum to 100% due to rounding. 


With regard to specific planning activities, care should be taken in the interpretation of the data. For instance, our 
study indicates that few active shooters overall approached or conducted surveillance on their target (14%, n = 9), 
and fewer still researched or studied the target site where the attack occurred (10%, n = 6). While this could indicate 
that the active shooters were uninterested in knowing about their targets or attack sites in advance or engaged in 
little tactical planning, this is inconsistent with the operational experience of the FBI. The likely reason for this 
finding is that the active shooters often attacked people and places with which they were already familiar. There was 


10 Calhoun, T., & Weston, S., (2003). Contemporary threat management. San Diego: Specialized Training Services; 

11 Fein, R. & Vossekuil, B. (1999). Assassination in the United States: an operational study of recent assassins, attackers, and near-lethal approachers .Journal of Forensic Sciences. 

12 Vossekuil, B., Fein, R., Reddy, M., Borum, R., & Modzeleski, W. (2004). The final report and findings of the safe school initiative: Implications for the prevention of school attacks in the United States. 
Washington, DC: U.S. Secret Service and the U.S. Department of Education. 
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a known connection between the active shooters and the attack site in the majority of cases (73%, n = 46), often a 
workplace or fonner workplace for those 18 and older (35%, n= 19), and almost always a school or fonner school 
for those younger than 18 (88%, n = 7), indicating that in most cases the active shooter was already familiar with 
both the attack site as well as the persons located at the site. Conversely, those active shooters with no affiliation to 
the targeted site behaved differently. Active shooters with no known connection to the site of their attack were more 
likely to conduct surveillance (p < .05) and research the site (p < .01). With routine contact, pre-attack surveillance 
could presumably be conducted concurrent to nonnalized activity and eliminate the need for a more formalized or 
detectable reconnaissance of a chosen target. 

The investigative files also demonstrated that only some active shooters researched or studied past attacks by others 
(21%, n= 13). This is not to say that other active shooters were unaware of past attacks — it is difficult to imagine 
that they did not have at least some basic knowledge of prior infamous shootings that received national media 
coverage. The FBI again suspects that this behavior may be underrepresented in the study sample, especially as we 
could not determine if active shooters researched past attacks in 46% of the cases. 

Preparing was narrowly defined for this story as actions taken to procure the means for the attack, typically items 
such as a handgun or rifle, ammunition, special clothing and/or body armor. The focus was on activities that could 
have been noticed by others (e.g., a visit to a gun store, the delivery of ammunition) and which were essential to the 
execution of the plan. The FBI was able to find evidence of time spent preparing in more cases than for time spent 
planning (likely reflecting the overt nature of procuring materials as opposed to the presumably largely internal 
thought process of planning). As Figure 7 demonstrates, in more than half of the cases where the time spent prepar¬ 
ing was known, active shooters spent one week or less preparing for the attack. 


FIGURE 7 



FIREARMS ACQUISITION 

As part of the review of the active shooter’s preparations, the FBI explored investigative records and attempted to 
identify how each active shooter obtained the fireann(s) used during the attack. Most commonly (40%, n = 25), the 
active shooter purchased a fireann or firearms legally and specifically for the purpose of perpetrating the attack. A 
very small percentage purchased firearms illegally (2%, n = 1) or stole the firearm (6%, n = 4). Some (11%, n = l ) 
borrowed or took the firearm from a person known to them. A significant number of active shooters (35%, n = 22) 
already possessed a firearm and did not appear (based on longevity of possession) to have obtained it for the express 
purpose of committing the shooting. 
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FIGURE 8 


100 Firearms Acquisition 

(N = 63) 

75 



*Data percentages detailed above add to greater than 100% as active shooters could have obtained multiple firearms in different ways. 


Considerations 

Active shooters generally take some time to plan and carry out the attack. However, retrospectively determining 
the exact moment when an active shooter decided to engage in violence is a challenging and imprecise process. 

In reviewing indicators of planning and preparing, the FBI notes that most active shooters (who demonstrated 
evidence of these processes in an observable manner) spent days, weeks, and sometimes months getting ready to 
attack. In fact, in those cases where it could be determined, 77% of the active shooters (n = 26) spent a week or 
longer planning their attack, and 46% (« = 21) spent a week or longer preparing. Readers are cautioned that simply 
because some active shooters spent less than 24 hours planning and preparing, this should not suggest that potential 
warning signs or evidence of an escalating grievance did not exist before the initiation of these behaviors. In the 
four cases where active shooters took less than 24 hours to plan and prepare for their attacks, all had at least one 
concerning behavior and three had an identifiable grievance. 

Perhaps unsurprisingly, active shooters tended to attack places already familiar to them, likely as a result of a personal 
grievance which motivated the attack and/or as a result of operational comfort and access. A unique challenge for 
safety, threat assessment, and security professionals will be to identify “outside” active shooters who are not already 
operating within the target environment. Pre-attack site surveillance by an outsider may be one observable behavior in 
physical or online worlds indicative of planning and preparation activities. 


STRESSORS 

Stressors are physical, psychological, or social forces that place real or perceived demands/pressures on an individual 
and which may cause psychological and/or physical distress. Stress is considered to be a well-established correlate of 
criminal behavior. 13 For this study, a wide variety of potential stressors were assessed, including financial pressures, 
physical health concerns, interpersonal conflicts with family, friends, and colleagues (work and/or school), mental 
health issues, criminal and civil law issues, and substance abuse. 14 


13 Felson, R.B., Osgood, D.W., Horney, J. & Wiernik, C. (2012). Having a bad month: General versus specific effects of stress on crime. Journal of Quantitative Criminology, 28, 347-363 for a 
discussion of various theories describing the relationship between stress and crime. 

14 See Appendix A. 
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The FBI recognizes that most (if not all) people in some way confront similar issues on a regular basis in their daily 
lives, and that most possess adequate personal resources, psychological resiliency, and coping skills to successfully 
navigate such challenges without resorting to violence. Therefore, the FBI focused on identifying stressors that 
appeared to have more than a minimal amount of adverse impact on that individual, and which were sufficiently 
significant to have been memorialized, shared, or otherwise noted in some way (e.g., in the active shooter’s own 
writings, in conversation with family or friends, work files, court records). Given the fluid nature of some (although 
not all) of the stressors, the analysis was limited to the year preceding the attack. 

The variables were treated as binary, that is, either the stressor was present or not, without regard for the number of 
separate circumstances giving rise to the stressor. So, an active shooter who had conflict with one family member 
and a shooter who had conflicts with several family members were both coded as “yes” for “conflict with other 
family members.” 

Overall, the data reflects that active shooters were typically experiencing multiple stressors (an average of 3.6 
separate stressors) in the year before they attacked. For example, in the year before his attack, one active shooter 
was facing disciplinary action at school for abuse of a teacher, was himself abused and neglected at home, and had 
significant conflict with his peers. Another active shooter was under six separate stressors, including a recent arrest 
for drunk driving, accumulating significant debt, facing eviction, showing signs of both depression and anxiety, and 
experiencing both the criminal and civil law repercussions of an incident three months before the attack where he 
barricaded himself in a hotel room and the police were called. 

The only stressor that applied to more than half the sample was mental health (62%, n = 39). Other stressors that 
were present in at least 20% of the sample were related to financial strain, employment, conflicts with friends and 
peers, marital problems, drug and alcohol abuse, other, conflict at school, and physical injury. 


TABLE 1:STRESSORS 


Stressors 

Number 

% | 

Mental health 

39 

62 

Financial strain 

31 

49 

Job related 

22 

35 

Conflicts with friends/peers 

18 

29 

Marital problems 

17 

27 

Abuse of illicit drugs/alcohol 

14 

22 

Other (e.g. caregiving responsibilities) 

14 

22 

Conflict at school 

14 

22 

Physical injury 

13 

21 

Conflict with parents 

11 

18 

Conflict with other family members 

10 

16 

Sexual stress/frustration 

8 

13 

Criminal problems 

7 

11 

Civil problems 

6 

10 

Death of friend/relative 

4 

6 

None 

1 

2 
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MENTAL HEALTH 

There are important and complex considerations regarding mental health, both because it is the most prevalent 
stressor and because of the common but erroneous inclination to assume that anyone who commits an active 
shooting must de facto be mentally ill. First, the stressor “mental health” is not synonymous with a diagnosis of 
mental illness. The stressor “mental health” indicates that the active shooter appeared to be struggling with (most 
commonly) depression, anxiety, paranoia, etc. in their daily life in the year before the attack. There may be complex 
interactions with other stressors that give rise to what may ultimately be transient manifestations of behaviors and 
moods that would not be sufficient to warrant a formal diagnosis of mental illness. In this context, it is exceedingly 
important to highlight that the FBI could only verify that 25% (« = 16) of the active shooters in Phase II were 
known to have been diagnosed by a mental health professional with a mental illness of any kind prior to the 
offense. 15 The FBI could not determine if a diagnosis had been given in 37% (« = 23) of cases. 

Of the 16 cases where a diagnosis prior to the incident could be ascertained, 12 active shooters had a mood disor¬ 
der; four were diagnosed with an anxiety disorder; three were diagnosed with a psychotic disorder; and two were 
diagnosed with a personality disorder. Finally, one active shooter was diagnosed with Autism spectrum disorder; 
one with a developmental disorder; and one was described as “other.” Having a diagnosed mental illness was 
unsurprisingly related to a higher incidence of concurrent mental health stressors among active shooters. 

Considerations 

It is clear that a majority of active shooters experienced multiple stressors in their lives before the attack. While the 
active shooters’ reactions to stressors were not measured by the FBI, what appears to be noteworthy and of impor¬ 
tance to threat assessment professionals is the active shooters’ ability to navigate conflict and resiliency (or lack 
thereof) in the face of challenges. Given the high prevalence of financial and job-related stressors as well as conflict 
with peers and partners, those in contact with a person of concern at his/her place of employment may have unique 
insights to inform a threat assessment. 

In light of the very high lifetime prevalence of the symptoms of mental illness among the U.S. population, formally 
diagnosed mental illness is not a very specific predictor of violence of any type, let alone targeted violence. 16,17,18 
Some studies indicate that nearly half of the U.S. population experiences symptoms of mental illness over their 
lifetime, with population estimates of the lifetime prevalence of diagnosable mental illness among U.S. adults at 
46%, with 9% meeting the criteria for a personality disorder. 19,20 Therefore, absent specific evidence, careful consid¬ 
eration should be given to social and contextual factors that might interact with any mental health issue before 
concluding that an active shooting was “caused” by mental illness. In short, declarations that all active shooters 
must simply be mentally ill are misleading and unhelpful. 


CONCERNING BEHAVIORS 

Concerning behaviors are observable behaviors exhibited by the active shooter. For this study, a wide variety of 
concerning behaviors were considered, including those related to potential symptoms of a mental health disorder, 
interpersonal interactions, quality of the active shooter’s thinking or communication, recklessness, violent media 
usage, changes in hygiene and weight, impulsivity, firearm behavior, and physical aggression. 21 Although these may 
be related to stressors in the active shooter’s life, the focus here was not on the internal, subjective experience of 


15 The number of documented, diagnosed mental illness may be the result of a number of factors, including those related to situational factors (access to health care) as well as those related to 
the study factors (access to mental health records). 

16 Elbogen, E.B., & Johnson, S.C. (2009). The intricate link between violence and mental disorder. Arch Gen Psychiatry,66(2), 152-161. 

17 died, S.A., and Frank, R.G. (2014). Mental illness and violence: Lessons from the evidence. American Journal of Public Health, 104, e5-e6 doi:10.2015/AJPH.2013.301710 

18 Monahan, J., Steadman, H. J., Silver, E., Applebaum, P.S., Clark Robbins, P., Mulvey, E. P., & Banks, S. (2001). Rethinking Risk Assessment: The MacArthur Study of Mental Disorder and Violence. 
Oxford, UK: Oxford University Press 

19 Kessler, R.C., Berglund, P., Dernier, 0., Jin, R., Merikangas, K.R., Walters, E.E. Lifetime prevalence and age-of-onset distributions of DSM-IV disorders in the National Comorbidity Survey 
Replication. Arch Gen Psychiatry. 2005:62(6): 593-602. 

20 Lenzweger, M.F., Lane, M.C., Loranger, A.W., Kessler, R.C., DSM-IV personality disorders in the National Comorbidity Survey Replication. Biol Psychiatry. 2007;62(6): 553-564. 

21 See Appendix B. 
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the active shooter, but rather on what was objectively knowable to others. So, while the assessment of stressors is 
meant to provide insight into the active shooter’s inner turmoil, the examination of concerning behaviors addresses 
a related but separate issue — the possibility of identifying active shooters before they attack by being alert for 
observable, concerning behaviors. The FBI looked for documented confirmation that someone noticed a facet of 
the shooter’s behavior causing the person to feel a “more than minimal” degree of unease about the well-being and 
safety of those around the active shooter. 

Before examining what behaviors were observable by others, it is useful to address the widespread perception 
that active shooters tend to be cut off from those around them. In general, the active shooters in Phase II were not 
completely isolated and had at least some social connection to another person. While most of the active shooters 
age 18 and older were single/never married (51%, n = 28) or separated/divorced (22%, n = 12) at the time of the 
attack, the majority did live with someone else (68%, n = 43). This percentage was slightly less (64%, n = 35) for 
only those active shooters who were 18 years or older. Most had significant in-person social interactions with at 
least one other person in the year before the attack (86%, n = 54), and more than a quarter of them had significant 
online interactions with another person within a year of the attack (27%, n = 17). All active shooters either: a) lived 
with someone, or b) had significant in-person or online social interactions. 

Since the observation of concerning behaviors offers the opportunity for intervention prior to the attack, this 
study examines not only what was observed, but when the observations were made, who made them, and what 
if anything the person(s) did with regard to these observations. To better serve threat assessment teams, mental 
health professionals, community resources, and law enforcement officials, the FBI expanded the inquiry to capture 
behaviors that may have been observed at any point (in many cases beyond one year) before the attack. 

Overall, active shooters showed concerning behaviors in multiple ways, with an average of 4.7 concerning behav¬ 
iors per active shooter. Behaviors observed in more than half of the sample were related to the shooter’s mental 
health 22 , interpersonal interactions, leakage (the communication to a third-party of an intent to harm someone, 
discussed with threats in a separate section), and the quality of the active shooter’s thinking or communication. 

Of note was that contextually inappropriate firearms behavior was noted in approximately one fifth of the active 
shooters, while drug and alcohol abuse figured even less prominently in the sample (for the purposes of the study, 
contextually inappropriate firearms behavior was defined as interest in or use of firearms that appeared unusual 
given the active shooter’s background and experience with firearms). 


TABLE 2: CONCERNING BEHAVIORS 


Concerning Behavior 

Number 

% I 

Mental health 

39 

62 

Interpersonal interactions 

36 

57 

Leakage 

35 

56 

Quality of thinking or communication 

34 

54 

Work performance* 

11 

46 

School performance** 

5 

42 

Threats/confrontations 

22 

35 

Anger 

21 

33 

Physical aggression 

21 

33 


Continues on next page 


22 Thirty-nine active shooters were experiencing a mental health stressor, and 39 active shooters showed concerning behaviors related to mental health, but the same 39 active shooters did not 
appear in each category; there were five active shooters who had a mental health stressor but who did not show a concerning behavior, and five other active shooters who showed a mental 
health-related concerning behavior but for whom there was no evidence of mental health stress. 
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Risk-taking 

13 

21 

Firearm behavior 

13 

21 

Violent media usage 

12 

19 

Weight/eating 

8 

13 

Drug abuse 

8 

13 

Impulsivity 

7 

11 

Alcohol abuse 

6 

10 

Physical health 

6 

10 

Other (e.g. idolizing criminals) 

5 

8 

Sexual behavior 

4 

6 

Quality of sleep 

3 

5 

Plygiene/appearance 

2 

3 


* Based on the 24 active shooters who were employed at the time of the offense 
** Based on the 12 active shooters who were students at the time of the offense 

When Were the Concerning Behaviors Noticed? 

Since the overwhelming majority of active shooters (all but three) displayed at least two concerning behaviors, 
there are a number of different ways to assess the data. One way is to examine the data by active shooter and to 
observe the first instance that any concerning behavior was noticed (this could not be determined for three active 
shooters). Figure 9 shows this data and helps frame the longest time before a shooting during which others were 
concerned about the active shooter’s behavior. 


FIGURE 9 



Again, this chart shows the first instance of any concerning behavior, and it should be kept in mind that this 
behavior might not have been the type that by itself would cause a reasonable person to be alarmed or to report it to 
others. For example, a co-worker who noticed that an active shooter had more than the normal amount of conflict 
with a supervisor might be unlikely to take any action. Perhaps only after an attack and with the benefit of hindsight 
would this singular behavior be considered to be — in and of itself— troubling or concerning. Yet, on average, 
each active shooter displayed four to five concerning behaviors over time. While it may only be the interaction and 
cumulative effect of these behaviors that would cause alarm, early recognition and detection of growing or interre¬ 
lated problems may help to mitigate the potential for violence. 
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In What Way Were the Concerning Behaviors Noticed? 

Concerning behaviors came to the attention to others in a variety of ways, with some far more common than 
others. The most prevalent way in which concerning behaviors were noticed was verbal communication by the 
active shooter (95%, n = 60), followed by observing the physical actions of the active shooter (86%, n = 54), 
written communication (27%, n = 17), and finally instances where concerning behavior was displayed online 
(16%, n = 10). A large majority of active shooters (89%, n = 56) demonstrated concerning behaviors that were 
noticed in multiple ways. 

Who Noticed the Concerning Behaviors? 

At least one person noticed a concerning behavior in every active shooter’s life, and on average, people from 
three different groups noticed concerning behaviors for each active shooter. As shown below, classmates (for 
those who were students), partners (for those in relationships), family members and friends most frequently 
noticed concerning behavior, followed by co-workers, other, and law enforcement: 


TABLE 3: WHO NOTICED CONCERNING BEHAVIORS 


Who Noticed 

Number 

% ! 

Schoolmate* 

11 

92 

Spouse/domestic partner** 

13 

87 

Teacher/school staff* 

9 

75 

Family member 

43 

68 

Friend 

32 

51 

Co-worker 

25 

40 

Other (e.g. neighbors) 

23 

37 

Law enforcement 

16 

25 

Online individual 

6 

10 

Religious mentor 

3 

5 


* Percentage calculated only with those active shooters who were students at the time of the offense 
** Percentage calculated only with those active shooters who were in a relationship at the time of the offense 


What, If Anything, Did the Concerned Party Do? 

If the person recognizes behaviors as problematic but takes no action, the opportunity for intervention is missed. 
Whether and how a person responds to an active shooter’s concerning behavior is likely influenced by a host of 
personal and situational factors (e.g., whether the behavior is threatening to the observer or others, the relationship 
of the observer and active shooter, avenues for anonymous reporting, and/or confidence in authorities or others to 
address the behavior). 

In this study, even in cases where an active shooter displayed a variety of concerning behaviors that might indicate 
an intent to act violently, the observer)s) of that information did not necessarily pass it along to anyone else. As 
shown above, the people most likely to notice concerning behaviors were those who knew the active shooter best 
— family, friends and classmates. For the very reason they are the people most likely to take note of concerning 
behaviors, they are also people who may feel constrained from acting on these concerns because of loyalty, 
disbelief, and/or fear of the consequences. 23 


23 Borum, R. (2013). Informing Lone-Offender Investigations. Criminology & Public Policy, 12(1), 103-112. 
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Again, keeping in mind that active shooters displayed multiple concerning behaviors and those who observed these 
behaviors might have responded in different ways to each, the most common response was to communicate directly 
to the active shooter (83%, n = 52) or do nothing (54%, n = 34). Thus, in many instances, the concern stayed 
between the person who noticed the behavior and the active shooter. 

The next most common responses were: report the active shooter to a non-law enforcement authority (51%, n = 32); 
discuss the concerning behavior with a friend or family member (49%, n = 31); and, report the active shooter to law 
enforcement authority (41%, n = 26). 

Considerations 

The analysis above is not intended to, nor could it, encompass the innumerable ways in which the observer of a 
concerning behavior might react. Nor does it suggest that every concerning behavior warrants assertive intervention; 
many of the concerning behaviors that registered with others likely would not have presaged deadly violence to a 
reasonable person. The FBI is aware that in retrospect certain facts may take on a heightened degree of significance 
that may not have been clear at the time. 

Nevertheless, understanding that there are often opportunities before a shooting to recognize concerning behaviors 
that may suggest progression toward violence, the FBI is highlighting the most common behaviors displayed in the 
sample. There is no single warning sign, checklist, or algorithm for assessing behaviors that identifies a prospective 
active shooter. Rather, there appears to be a complex combination of behaviors and interactions with bystanders 
that may often occur in the days, weeks, and months leading up to an attack. Early recognition and reporting of 
concerning behaviors to law enforcement or threat assessment professionals may initiate important opportunities 
for mitigation. 


PRIMARY GRIEVANCE 

A grievance is defined for this study as the cause of the active shooter’s distress or resentment; a perception — not 
necessarily based in reality — of having been wronged or treated unfairly or inappropriately. 24,25 26 More than a 
typical feeling of resentment or passing anger, a grievance often results in a grossly distorted preoccupation with 
a sense of injustice, like an injury that fails to heal. These thoughts can saturate a person’s thinking and foster a 
pervasive sense of imbalance between self-image and the (real or perceived) humiliation. This nagging sense of 
unfairness can spark an overwhelming desire to “right the wrong” and achieve a measure of satisfaction and/or 
revenge. In some cases, an active shooter might have what appeared to be multiple grievances but, where possible, 
the FBI sought to determine the primary grievance. Based on a review of the academic literature and the facts of 
the cases themselves, the FBI identified eight categories of grievances, with an additional category of “other” for 
grievances that were entirely idiosyncratic. 

As shown in the following table, the FBI could not identify a primary grievance for 13 (21%) of the active 
shooters, either because they did not have one or because there was insufficient evidence to determine whether 
one existed. While it may be particularly difficult to understand the motivation(s) for attacks that do not appear 
to be based on identifiable grievances, these active shooters still displayed concerning behaviors, were under 
identifiable stressors, and engaged in planning and preparation activities. For example, for the active shooters 
where no grievance could be identified, all had at least two behaviors (with an average of 5.4 behaviors) that 
were noted to be concerning by others. 


24 Calhoun, T., & Weston, S., (2003). 

25 Fein, R., & Vossekuil, B. (1999). 

26 Vossekuil, B., Fein, R., Reddy, M., Borum, R., & Modzeleski, W. (2004). 
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The majority (79%, n = 50) of the active shooters did appear to be acting in accord with a grievance of some kind. 

Of course, the grievance itself may not have been reasonable or even grounded in reality, but it appeared to serve as 
the rationale for the eventual attack, giving a sense of purpose to the shooter. Most of these grievances seem to have 
originated in response to some specific action taken regarding the active shooter. Whether interpersonal, employment, 
governmental, academic, or financial, these actions were (or were perceived to be) directed against the active shooter 
personally. In contrast, grievances driven by more global or broad considerations — such as ideology or hatred of a 
group — account for less than 7% of the overall cases. In general then, active shooters harbored grievances that were 
distinctly personal to them and the circumstances of their daily lives. 


TABLE 4: PRIMARY GRIEVANCE 


|j Primary Grievance 

Number 

% 1 

Adverse interpersonal action against the shooter 

21 

33 

Adverse employment action against the shooter 

10 

16 

Other (e.g. general hatred of others) 

6 

10 

Adverse governmental action against the shooter 

3 

5 

Adverse academic action against the shooter 

2 

3 

Adverse financial action against the shooter 

2 

3 

Domestic 

2 

3 

Hate crime 

2 

3 

Ideology/extremism 

2 

3 

Unknown 

13 

21 


Precipitating Events 

Of the 50 active shooters who had an identifiable grievance, nearly half of them experienced a precipitating 
or triggering event related to the grievance (44%, n = 22). Seven active shooters (14%) did not experience a 
precipitating event, and the FBI could not determine whether the remaining 21 (42%) did. Precipitating events 
generally occurred close in time to the shooting and included circumstances such as an adverse ruling in a legal 
matter, romantic rejection, and the loss of a job. 

These precipitating events were of more consequence in the timing of the attack, and while they appear to have 
accelerated the active shooter’s movement on the trajectory to violence, they did not by themselves appear to set 
the course. 

Considerations 

Of course, many people have grievances and never act violently. What caused the active shooters in this study to 
act the way they did cannot be explained simply by the presence of a grievance. There was likely the interaction 
of a variety of operational considerations and psychological stressors that eventually crystallized in the decision 
to ignore non-violent options and choose to attack. However, the types of grievances most commonly experienced 
by the active shooters in this study may be important considerations for the many threat assessment teams and law 
enforcement professionals who work each day to assess a subject’s progression along the pathway to violence. 
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TARGETING 

For this study, a target is defined as a person or group of people who were identifiable before the shooting 
occurred and whom the active shooter intended to attack. It was not necessary that the active shooter knew the 
target by name; intending to attack a person holding a position at or affiliated with a business, educational facil¬ 
ity, or in a governmental agency sufficed. The target could be a group, so long as members of that group could 
have been identified prior to the attack. 

In cases where the victims could not reasonably have been identified prior to the shooting, the active shooter was 
deemed to have selected the victims at random. While there is some element of selection in any attack where there 
is more than one potential victim (unless the active shooter literally does not aim at all), the FBI considered victims 
to be random where there was: 1) no known connection between the active shooter and the victims, and 2) the 
victims were not specifically linked to the active shooter’s grievance. 

In many cases, there was a mix of targeted and random victims in the same shooting. The typical circumstance 
occurred when an active shooter went to a location with targets in mind and also shot others who were at the same 
location, either because they presented some obstacle in the attack or for reasons that could not be identified. 

The overall numbers for targeted and random victims are listed below: 


FIGURE 10 



RANDOM VICTIMS 
(37%, n= 23) 





*Does not sum to 100% due to rounding. 


Considerations 

While approximately one-third of active shooters in this sample victimized only random members of the public, 
most active shooters arrive at a targeted site with a specific person or persons in mind. Awareness of targeting 
behaviors can provide valuable insight for threat assessment professionals. Relatedly, the FBI has observed that 
when an active shooter’s grievance generalizes — that is, expands beyond a desire to punish a specific individual 
to a desire to punish an institution or community — this should be considered to be progression along a trajectory 
towards violence and ultimately a threat-enhancing characteristic. 
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SUICIDE: IDEATION AND ATTEMPTS 

For this study, “suicidal ideation” was defined as thinking about or planning suicide, while “suicide attempt” was 
defined as a non-fatal, self-directed behavior with the intent to die, regardless of whether the behavior ultimately 
results in an injury of any kind. Although these definitions are broad, the FBI concluded that an active shooter had 
suicidal ideation or engaged in a suicide attempt only when based on specific, non-trivial evidence. 

Nearly half of the active shooters had suicidal ideation or engaged in suicide-related behaviors at some time prior to 
the attack (48%, n = 30), while five active shooters (8%) displayed no such behaviors (the status of the remaining 
28 active shooters was unknown due to a lack of sufficient evidence to make a reasonable detennination). 

An overwhelming majority of the 30 suicidal active shooters showed signs of suicidal ideation (90%, n = 27), and 
seven made actual suicide attempts (23%). Nearly three-quarters (70%, n = 21) of these behaviors occurred within 
one year of the shooting. 

Considerations 

The high levels 27 of pre-attack suicidal ideation — with many appearing within 12 months of the attack — are 
noteworthy as they represent an opportunity for intervention. If suicidal ideation or attempts in particular are 
observed by others, reframing bystander awareness within the context of a mass casualty event may help to empha¬ 
size the importance of telling an authority figure and getting help for the suicidal person. Without stigmatizing 
those who struggle with thoughts of self-harm, researchers and practitioners must continue to explore those active 
shooters who combined suicide with externalized aggression (including homicidal violence) and identify the 
concurrent behaviors that reflect this shift. 


CONCERNING COMMUNICATIONS 

One useful way to analyze concerning communications is to divide them into two categories: threats/confrontations 
and leakage of intent. 

Th reats/Co nf ro ntat io ns 

Threats are direct communications to a target of intent to harm and may be delivered in person or by other means 
(e.g., text, email, telephone). For this study, threats need not be verbalized or written; the FBI considered in-person 
confrontations that were intended to intimidate or cause safety concerns for the target as falling under the category 
of threats as well. 

More than half of the 40 active shooters who had a target made threats or had a prior confrontation (55%, n = 22). 
When threats or confrontations occurred, they were almost always in person (95%, n = 21) and only infrequently in 
writing or electronically (14%, n = 3). Two active shooters made threats both in person and in writing/electronically. 

Leakage 

Leakage occurs when a person intentionally or unintentionally reveals clues to a third-party> about feelings, 
thoughts, fantasies, attitudes or intentions that may signal the intent to commit a violent act. 28 Indirect threats of 
harm are included as leakage, but so are less obvious, subtle threats, innuendo about a desire to commit a violent 
attack, or boasts about the ability to harm others. Leakage can be found not only in verbal communications, but 


27 The National Survey on Drug Use and Health (2015) shows that in 2015:4% of adults had serious thoughts of suicide, 1.1% made serious plans, and 0.6% attempted suicide 

( https://www.samhsa.aov/data/sites/default/files/NSDUH-DR-FFR3-2015/NSDUH-DR-FFR3-2015.htm ) 

28 Meloy, J. R. & O'Toole, M. E. (2011). The concept of leakage in threat assessment. Behavioral Sciences and the Law, 29, 513-527 
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also in writings (e.g., journals, school assignments, artwork, poetry) and in online interactions (e.g., blogs, tweets, 
texts, video postings). Prior research has shown that leakage of intent to commit violence is common before attacks 
perpetrated by both adolescents and adults, but is more common among adolescents. 29,30,31 

Here, too, leakage was prevalent, with over half of the active shooters leaking intent to commit violence (56%, 
n = 35). In the Phase II sample, 88% (« = 7) of those active shooters age 17 and younger leaked intent to commit 
violence, while 51% (n = 28) of adult active shooters leaked their intent. The leaked intent to commit violence was 
not always directed at the eventual victims of the shootings; in some cases what was communicated was a more 
general goal of doing harm to others, apparently without a particular person or group in mind. For example, one 
active shooter talked to a clerk at a gas station about killing “a family” and another expressed interest in becoming 
a sniper like a character featured in The Turner Diaries. In 16 of the 40 cases (40%) where the active shooter had a 
target, however, the leaked intent to act violently was directly pertaining to that target. In these cases, the leakage 
was generally a statement to a third-party of the intent to specifically harm the target. 

LegacyTokens 

Finally, the FBI considered whether or not an active shooter had constructed a “legacy token” which has been 
defined as a communication prepared by the offender to claim credit for the attack and articulate the motives 
underlying the shooting. 32 Examples of legacy tokens include manifestos, videos, social media postings, or other 
communications deliberately created by the shooter and delivered or staged for discovery by others, usually near in 
time to the shooting. In 30% (n = 19) of the cases included in this study, the active shooter created a legacy token 
prior to the attack. 

Considerations 

Although more than half of the active shooters with pre-attack targets made threats (/? = 22), in the majority (65%) 
of the overall cases no threats were made to a target, and the FBI cautions that the absence of a direct threat should 
not be falsely reassuring to those assessing the potential for violence raised by other circumstances and factors. Nor 
should the presence of a threat be considered conclusive. There is a significant amount of research and experience 
to demonstrate that direct threats are not correlated to a subsequent act of targeted violence. 33,34,35,36,37,38 

It is important to highlight that in this Phase II study the overwhelming majority of direct threats were verbally 
delivered by the offender to a future victim. Only a very small percentage of threats were communicated via 
writing or electronically. In many ways this is not surprising. Written, directly communicated threats against 
a target (e.g., “I’m going to shoot and kill everyone here on Tuesday”) often spark a predictable response that 
includes a heightened law enforcement presence and the enhancement of security barriers. These responses are 
highly undesirable to an offender planning an active shooting. 39 Verbal threats issued directly to another person 
appear to be far more common among the active shooters included in the Phase II study. 


29 Hemple, A., Meloy, J.R., & Richards, T. (1999). Offender and offense characteristics of a nonrandom sample of mass murderers. Journal of the American Academy of Psychiatry and the Law, 27, 
213-225. Meloy, J.R., Hoffman, J., Guldimann, A., & James, D. (2011). The role of warning behaviors in threat assessment: An exploration and suggested typology. Behavioral Sciences and the 
Law, 30,256-279. 

30 Meloy, J.R.& O'Toole, M.E. (2011). 

31 Meloy, J.R., Hoffman, J., Guldimann, A., & James, D. (2011). The role of warning behaviors in threat assessment: An exploration and suggested typology. Behavioral Sciences and the Law, 30, 
256-279. 

32 Simons, A.,&Tunkel, R. (2014). The assessment of anonymous threatening communications. In J.R. Meloy &J. Hoffman (Eds.), International handbook of threat assessment (gg. 195-213). New 
York: Oxford University Press. 

33 Borum, R., Fein, R. Vossekuil, B.,& Berglund, J. (1999). Threat assessment: Defining an approach for evaluating risk of targeted violence. Behavioral Sciences and the Law, 17,323-337. 

34 Calhoun, F. (1998). Hunters and howlers: Threats and violence against federal judicial officials in the United States, 77S9-7993. Arlington, VA: US Marshals Service. 

35 Calhoun T. & Weston, S. (2003). 

36 Dietz, P., Matthews, D., Martell, D., Stewart,!, Hrouda, D., & Warren, J. (1991a). Threatening and otherwise inappropriate letters to members of the United States Congress .Journal of Forensic 
Sciences, 36, 1445-1468. 

37 Dietz, R, Matthews, D.,Van Duyne, C., Martell, D., Parry, C., Stewart, T, et al. (1991b). Threatening and otherwise inappropriate letters to Hollywood celebrities .Journal of Forensic Sciences, 36, 
185-209. 

38 Meloy, J.R. (2000). Violence risk and threat assessment. San Diego: Specialized Training Services. 

39 Simons A.&Tunkel, R. (2014) 
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Whether verbal or written, concerning communications are challenging as those on the receiving end must assess 
sometimes ominously vague or nebulous verbiage. Such confusion can create doubt in the listener’s mind as to 
the communicator’s true intent toward violence. 40 As law enforcement agencies continue to remind bystanders 
if they “see something, say something” it becomes relevant to use this data (particularly regarding leakage 
behaviors) to lower the internal threshold for reporting, even in the face of ambiguous language. It is troubling 
to note that no bystanders reported instances of leakage to law enforcement, perhaps out of a fear of overreacting 
or perhaps due to a lack of understanding as to what law enforcement’s response would be. This suggests that 
more robust efforts need to be made to educate bystanders (especially students and adolescents) on the nature of 
leakage and its potential significance. 


Limitations 


The findings presented in this report reflect a thorough and careful review of the data derived almost exclusively 
from law enforcement records. Nevertheless, there are limitations to the study which should be kept in mind before 
drawing any conclusions based on the findings. 

First, the Phase I study on which the present analysis is based included only a specific type of event. Shootings 
must have been (a) in progress in a public place and (b) law enforcement personnel and/or citizens had the potential 
to affect the outcome of the event based on their responses. The FBI acknowledges there is an inherent element of 
subjectivity in deciding whether a case meets the study criteria. Moreover, while every effort was made to find all 
cases between 2000 and 2013 which met the definition, it is possible that cases which should have been included in 
the study were not identified. Overall, as with the Phase I study, the incidents included in the Phase II study were 
not intended to and did not comprise all gun-related violence or mass or public shootings occurring between 2000 
and 2013. 

Second, although the FBI took a cautious approach in answering protocol questions and limited speculation by 
relying on identifiable data, there was some degree of subjectivity in evaluating which of the original 160 cases had 
sufficient data to warrant inclusion in the study. 

Third, while reliance on official law enforcement investigative files was reasonable based on the study’s objectives, 
the level of detail contained in these files was not uniform throughout and the FBI was not able to definitively 
answer all protocol questions for all subjects. 

This is a purely descriptive study. With the exception of mental health and suicidal behaviors, the FBI did not make 
any comparisons to the general population or to criminals who were not active shooters. Therefore, we cannot 
postulate on the probability as to whether some of the behaviors and characteristics seen here would also have 
been seen in other populations. Furthermore, the FBI cautions readers to not treat the observed behaviors as having 
predictive value in determining if a person will become violent or not, as the findings and observations presented 
herein are not a “checklist” but instead are offered to promote awareness among potential bystanders and for 
consideration in the context of a thorough, holistic threat assessment by trained professionals. Future research may 
benefit from comparisons between those who completed active shooting attacks and those who planned to attack 
but were disrupted prior to the offense, and/or in comparison to those individuals who may have displayed concern¬ 
ing behaviors but had no true intent to commit an act of targeted violence. 


40 The FBI noted that there were four cases where threats were made and someone notified law enforcement (out of 22 cases where a threat was made, or 14%) 
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Conclusion 


The ability to utilize case files (as compared to open-source documents) allowed the FBI to carefully examine 
both the internal issues experienced and the behaviors demonstrated by active shooters in the weeks and months 
preceding their attacks. What emerges is a complex and troubling picture of individuals who fail to successfully 
navigate multiple stressors in their lives while concurrently displaying four to five observable, concerning 
behaviors, engaging in planning and preparation, and frequently communicating threats or leaking indications of 
an intent to attack. As an active shooter progresses on a trajectory towards violence, these observable behaviors 
may represent critical opportunities for detection and disruption. 

The information contained in this Phase II report can be utilized by myriad safety stakeholders. The successful 
prevention of an active shooting frequently depends on the collective and collaborative engagement of varied 
community members: law enforcement officials, teachers, mental health care professionals, family members, threat 
assessment professionals, friends, social workers, school resource officers.. .and many others. A shared awareness 
of the common observable behaviors demonstrated by the active shooters in this study may help to prompt inquiries 
and focus assessments at every level of contact and every stage of intervention. 

While many dedicated professionals work to thwart active shootings, the FBI suspects that future active shooters 
themselves are looking for ways to avoid detection and maximize damage as they plan and prepare for their acts of 
violence. The prevention of these future attacks will depend on our ability to remain agile and recognize evolving 
pre-attack behaviors. To that end, the FBI continues to study active shooters to better inform all safety stakeholders 
and to support the development of sound threat mitigation strategies. 

As tragically seen from current events, active shootings continue to impact our nation. The FBI hopes that the 
information contained in this Phase II study will help in efforts to promote safety across all communities. 
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Appendix A: 

STRESSORS 

Abuse of illicit drugs or alcohol: difficulties caused by the effects of drugs/alcohol and/or frustrations related to 
obtaining these substances. 

Civil legal problems: being party to a non-trivial lawsuit or administrative action. 

Conflict with friends/peers: general tension in the relationship beyond what is typical for the active shooter’s age 
or specific instances of serious and ongoing disagreement. 

Conflict with other family members: general tension in the relationship beyond what is typical for the active 
shooter’s age, or specific instances of serious and ongoing disagreement. 

Conflict with parents: general tension in the relationship beyond what is typical for the active shooter’s age, or 
specific instances of serious and ongoing disagreement. 

Criminal legal problems: arrests, convictions, probation, parole. 

Death of friend/relative: death that caused emotional or psychological distress. 

Financial strain: related to job loss, debt collection, potential or actual eviction, inability to pay normal and usual 
daily bills. 

Job-related problems: ongoing conflicts with co-workers or management, pervasive poor performance evaluations, 
or disputes over pay or leave. 

Marital problems/conflict with intimate partner(s)/divorce or separation: difficulties in the relationship 
that were a consistent source of psychological distress and/or which did or were likely to lead to the end of the 
relationship or the desire to end the relationship. 

Mental health problems: symptoms of anxiety, depression, paranoia, or other mental health concerns that have a 
negative effect on daily functioning and/or relationships. 

Other: any other circumstance causing physical, psychological, or emotional difficulties that interfere in a 
non-trivial way with normal functioning in daily life. 

Physical injury: physical condition/injury that significantly interfered with or restricted normal and usual 
activities. 

School-related problems: conflicts with teachers and staff that go beyond single instances of minor discipline; 
pervasive frustration with academic work; inability to follow school rules. 

Sexual stress/frustration: pronounced and ongoing inability to establish a desired sexual relationship. 
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Appendix B: 

CONCERNING BEHAVIORS 

Amount or quality of sleep: unusual sleep patterns or noticeable changes in sleep patterns. 

Anger: inappropriate displays of aggressive attitude/temper. 

Change, escalation, or contextually inappropriate firearms behavior: interest in or use of firearms that 
appears unusual given the active shooter’s background and experience with firearms. 

Changes in weight or eating habits: significant weight loss or gain related to eating habits. 

Hygiene or personal appearance: noticeable and/or surprising changes in appearance or hygiene practices. 

Impulsivity: actions that in context appear to have been taken without usual care or forethought. 

Interpersonal interactions: more than the usual amount of discord in ongoing relationships with family, 
friends, or colleagues. 

Leakage: communication to a third-party of the intent to harm another person. 

Mental health: indications of depression, anxiety, paranoia or other mental health concerns. 

Other: any behavior not otherwise captured in above categories that causes more than a minimal amount of 
worry in the observer. 

Physical aggression: inappropriate use of force; use of force beyond what was usual in the circumstances. 
Physical health: significant changes in physical well-being beyond minor injuries and ailments. 

Quality of thinking or communication: indications of confused or irrational thought processes. 

Risk-taking: actions that show more than a usual disregard for significant negative consequences. 

School performance: appreciable decrease in academic performance; unexplained or unusual absences. 
Sexual behavior: pronounced increases or decreases in sexual interest or practices. 

Threats/Confrontations: direct communications to a target of intent to harm. May be delivered in person or by 
other means (e.g., text, email, telephone). 

Use of illicit drugs or illicit use of prescription drugs: sudden and/ recent use or change in use of drugs; use 
beyond social norms that interferes with the activities of daily life. 

Use or abuse of alcohol: sudden and/or recent use or changes in use of alcohol; use beyond social norms that 
interferes with the activities of daily life. 

Violent media usage: more than a usual age-appropriate interest in visual or aural depictions of violence. 
Work performance: appreciable decrease in job performance; unexplained or unusual absences. 
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